US8997253B2 - Method and system for preventing browser-based abuse - Google Patents

Method and system for preventing browser-based abuse Download PDF

Info

Publication number
US8997253B2
US8997253B2 US13/126,645 US200913126645A US8997253B2 US 8997253 B2 US8997253 B2 US 8997253B2 US 200913126645 A US200913126645 A US 200913126645A US 8997253 B2 US8997253 B2 US 8997253B2
Authority
US
United States
Prior art keywords
function
browser
extension module
original
window
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US13/126,645
Other languages
English (en)
Other versions
US20110283366A1 (en
Inventor
Oh-Hyun Kwon
Hyun-Jong Kim
Chang-Hwan Lee
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Naver Cloud Corp
Original Assignee
NHN Business Platform Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by NHN Business Platform Corp filed Critical NHN Business Platform Corp
Assigned to NHN BUSINESS PLATFORM CORPORATION reassignment NHN BUSINESS PLATFORM CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: KIM, HYUN-JONG, KWON, OH-HYUN, LEE, CHANG-HWAN
Publication of US20110283366A1 publication Critical patent/US20110283366A1/en
Application granted granted Critical
Publication of US8997253B2 publication Critical patent/US8997253B2/en
Assigned to NAVER CLOUD CORP. reassignment NAVER CLOUD CORP. CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: NAVER BUSINESS PLATFORM CORP.
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F15/00—Digital computers in general; Data processing equipment in general
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2119—Authenticating web pages, e.g. with suspicious links

Definitions

  • the present invention relates to a method and system for preventing browser-based abuse.
  • An Internet browser may be used with a browser function extension module, to increase the convenience of a user during web surfing.
  • An extension module may be connected to a browser, to obtain data and/or control operations of the Internet browser. Consequently, an extension module may be used maliciously for computer hacking, data theft, and the like.
  • Unauthorized extension modules have become more varied and are continuously increasing in number. For example, unauthorized extension modules have been identified that manipulate a real time search word, a related search word, a site retrieval result, and the like, such that a fake keyword may be transmitted to search and portal sites, via the browser function extension module (which may be referred to as retrieval abuse).
  • a popup window may be added or an original webpage description may be changed and replaced, due to a browser function extension module performing an input value interception (which may be referred to as advertisement abuse).
  • a false click may be transmitted to search and portal sites (which may be referred to as click abuse).
  • a cookie value used by a browser function extension module of webpage may be falsified (which may be referred to as cookie abuse).
  • An aspect of the present invention provides a method and system to prevent the operation of unauthorized browser function extension modules.
  • An aspect of the present invention provides a method and system to prevent unauthorized browser function extension modules from acquiring a document through a browser object, by intercepting a function for acquiring the document.
  • An aspect of the present invention provides a method and system to prevent an unauthorized browser function extension module from acquiring a component of a document through a browser object, by intercepting a function for acquiring the component of the document.
  • An aspect of the present invention provides a method and system to prevent the acquisition of a document through a window message, by intercepting a window procedure function for processing the window message.
  • An aspect of the present invention provides a method and system to block the connection of an unauthorized browser extension module to the Internet browser.
  • a method of preventing browser-based abuse including determining whether a browser function extension module requests an unauthorized access for acquiring data of an Internet browser, and blocking the unauthorized access.
  • the determining may include substituting a new function for an original function capable of acquiring data of the Internet browser, checking an object requesting the new function through the browser function extension module, and determining whether the object requesting the new function is authorized.
  • the substituting may include acquiring address information of functions associated with a browser object of the Internet browser, storing and backing up an address of the original function corresponding to a position of the original function, declaring the new function having the same format as the original function, and recording an address of the declared new function at the position of the original function.
  • the substituting may include determining a main window of the Internet browser, determining a view window of the Internet browser based on the main window, and substituting a new window procedure function for an original window procedure function of the view window, while processing a message delivered to the Internet browser.
  • the determining whether the access is an unauthorized access for acquiring data of the Internet browser may include extracting at least one connection point associated with an operation of the Internet browser, through a browser object of the Internet browser, checking a browser function extension module connected to each extracted connection point, and determining whether the checked browser function extension module is authorized.
  • a system of preventing browser-based abuse including an abuse determining unit to determine whether an access based on a browser function extension module is an unauthorized access for acquiring data of an Internet browser, and an abuse blocking unit to block the access based on the browser function extension module, when the access is determined to be an unauthorized access.
  • an unauthorized browser function extension module from acquiring a document of a browser object, by intercepting a function for acquiring the document.
  • an unauthorized browser function extension module from acquiring a component of a document of a browser object, by intercepting a function for acquiring the component of the document.
  • FIG. 1 is a diagram illustrating an overall operation with respect to a method of preventing browser-based abuse, according to an embodiment of the present invention.
  • FIG. 2 is a flowchart illustrating an operation of determining whether an access by a browser function extension module is an unauthorized access, through a substitution of a function, according to an embodiment of the present invention.
  • FIG. 3 is a flowchart illustrating an operation of substituting a function for acquiring a document and/or a component of the document, according to an embodiment of the present invention.
  • FIG. 4 is a diagram illustrating an operation of preventing abuse with respect to an original function for acquiring a document and/or a component of the document, according to an embodiment of the present invention.
  • FIG. 5 is a diagram illustrating an operation of substituting an original window procedure function for processing a window message, according to an embodiment of the present invention.
  • FIG. 6 is a diagram illustrating an operation of preventing abuse with respect to an original function for processing a window message, according to an embodiment of the present invention.
  • FIG. 7 is a flowchart illustrating an operation of determining whether an access by a browser function extension module through a connection point is an unauthorized access, according to an embodiment of the present invention.
  • FIG. 8 is a flowchart illustrating an operation of extracting a connection point of an Internet browser, according to an embodiment of the present invention.
  • FIG. 9 is a diagram illustrating an operation of preventing abuse through an unauthorized browser function extension module connected to a connection point, according to an embodiment of the present invention.
  • FIG. 10 is a diagram illustrating an overall configuration of a system for preventing browser-based abuse using a function substitution, according to an embodiment of the present invention.
  • FIG. 11 is a diagram illustrating a further function of a substitution unit that substitutes for an original function to acquire a document or a component of the document, according to an embodiment of the present invention.
  • FIG. 12 is a diagram illustrating another substitution unit that substitutes an original function processing a window message, according to an embodiment of the present invention.
  • FIG. 13 is a diagram illustrating another function of an abuse determining unit that prevents abuse through a connection point, according to an embodiment of the present invention.
  • FIG. 1A illustrates a system in which a method of preventing browser-based abuse is performed, according to an exemplary embodiment of the present invention.
  • FIG. 1B illustrates an overview of the method, according to an exemplary embodiment of the present invention.
  • Internet browsing may be implemented using a web server 101 and a client terminal 102 .
  • an Internet browser 103 stored on the terminal 102 may be used to access the web server 102 , to provide information to the terminal 102 .
  • the terminal 102 may request information from the server 101 , and the server 101 may retrieve the requested information, which is then delivered to the terminal 102 .
  • the information delivered by the server 101 may be provided to a user through the Internet browser 103 .
  • a browser function extension module may be used to provide an additional functionality to the Internet browser 103 .
  • the browser function extension module may correspond to a program connected to the Internet browser 103 as an add-on and loaded in a memory.
  • the browser function extension module may correspond to a browser helper object (BHO).
  • BHO browser helper object
  • the Internet browser 103 may load connected browser function extension modules 104 - 1 , 104 - 2 , and 104 - 3 in a memory.
  • the browser function extension modules 104 - 1 , 104 - 2 , and 104 - 3 may be loaded in the same memory as the Internet browser 103 .
  • the browser function extension module may be applied to another Internet browser.
  • the browser function extension module may receive an IWebBrowser2 corresponding to an object indicating Internet Explorer to the Internet browser 103 .
  • the browser function extension modules 104 - 1 , 104 - 2 , and 104 - 3 may detect a typical operation of the Internet browser 103 through IWebBrowser2 and may monitor messages occurring in the browser.
  • the browser function extension modules 104 - 1 , 104 - 2 , and 104 - 3 may be connected to the Internet browser 103 and control the Internet browser 103 .
  • browser function extension modules may be developed for an unauthorized purpose, and thus, various types of abuse may occur due to an unauthorized extension module.
  • An abuse prevention module 105 may be connected to the Internet browser 103 as an add-on type program similar to the browser function extension modules 104 - 1 , 104 - 2 , and 104 - 3 .
  • the abuse prevention module 105 may block the operation of an unauthorized browser function extension module.
  • the abuse prevention module 105 may block abuse of the browser function extension modules 104 - 1 , 104 - 2 , and 104 - 3 , according to the method shown in FIG. 1B .
  • the abuse prevention module 105 may determine whether an access based on a browser function extension module is an unauthorized access, such as an access designed for acquiring data of the Internet browser 103 .
  • the access based on a browser function extension module may include an access of the browser function extension module desiring to control the Internet browser while being connected to the Internet browser.
  • the access based on a browser function extension module may include the browser function extension module attempting to acquire data of the Internet browser, through a functional call or a delivery of a message.
  • the access based on a browser function extension module may is not limited to the above.
  • the abuse prevention module 105 may block the access based on a browser function extension module, when the access based on a browser function extension module is determined to be an unauthorized access.
  • the abuse prevention module 105 may block a connection of an unauthorized browser function extension module to the Internet browser, or may block the acquisition of data from the Internet browser.
  • a method of preventing browser-based abuse may be implemented by an abuse prevention module.
  • the abuse prevention module may also correspond to a browser function extension module. That is, the abuse prevention module may block the operation of an unauthorized browser function extension module connected to the Internet browser.
  • FIG. 2 is a flowchart illustrating an operation of determining whether an access by a browser function extension module is an unauthorized access, through the substitution of a function, according to an embodiment of the present invention.
  • FIG. 2 describes a scheme of preventing an unauthorized browser function extension module from requesting an original function capable of acquiring data of an Internet browser, by intercepting the original function.
  • the original function may include a function capable of acquiring a document through the Internet browser, or a function capable of acquiring a component of the document.
  • the original function may correspond to a function to acquire a Hyper Text Markup Language (HTML) object using the Internet browser.
  • HTML Hyper Text Markup Language
  • operation S 101 includes operation S 201 , operation S 202 , and operation S 203 .
  • an abuse prevention module may substitute a new function for an original function capable of acquiring data of the Internet browser.
  • the abuse prevention module may substitute a hook function for the original function.
  • the hook function may have the same format as the original function.
  • the abuse prevention module may prevent execution of the original function by the unauthorized browser function extension module, by intercepting the original function before it is executed. Even though the browser function extension module attempts to call the original function, the hook function is substituted for the original function by the abuse prevention module. Further operations of substituting a hook function for the original function will be described with reference FIG. 3 and FIG. 5 .
  • the abuse prevention module may check an object requesting the new function.
  • the abuse prevention module may determine the type of browser function extension module that requests the new function. For example, the browser function extension module may check the browser function extension module by determining an address where the new function is to return.
  • the abuse prevention module may determine whether the object calling the new function is authorized. For example, the abuse prevention module may determine whether the browser function extension module is authorized, using a list of normal browser function extension modules used in the Internet browser. If the browser function extension module is included in the list of normal browser function extension modules used in the Internet browser, the abuse prevention module may determine the browser function extension module is an authorized module.
  • FIG. 3 is a flowchart illustrating an operation of substituting a function for acquiring a document and a component of the document according to an embodiment of the present invention.
  • FIG. 3 describes an operation of preventing abuse committed by an unauthorized module, by intercepting a document in an HTML scheme, or a component of the document, and falsifying and modifying the document when an Internet browser provides the document to a user.
  • the document may include another configuration in a format of a language other than HTML.
  • operation S 201 of substituting a new function for an original function includes operation S 301 , operation S 302 , operation S 303 , and operation S 304 .
  • an abuse prevention module may acquire address information of functions associated with a browser object of the Internet browser.
  • the abuse prevention module may acquire a virtual function table including addresses of functions associated with the browser object of the Internet browser.
  • the browser object may include an object based on a component object model (COM) corresponding to a previously built binary form.
  • COM component object model
  • the COM-based object may be built so as to guarantee the request and use an object in a binary form and to guarantee to reuse the object.
  • a method of preventing browser-based abuse may block the acquisition of an HTML document.
  • the IWebBrowser2 object may correspond to a unique object included in each Internet browser. That is, the IWebBrowser2 object may indicate the Internet browser.
  • the IWebBrowser2 object may control the Internet browser, by commanding the Internet browser to navigate to a predetermined webpage.
  • the IWebBrowser2 object may acquire an HTML document of a current webpage and refer to or correct a description of the HTML document.
  • the IWebBrowser2 object may correspond to an object provided to a browser function extension module stored where the Internet browser is loaded.
  • a browser function extension module having an unauthorized purpose may be provided with the IWebBrowser2 object from the Internet browser, thereby obtaining an HTML document of a current webpage displayed by the Internet browser, to manipulate or falsify an HTML document.
  • the abuse prevention module may prevent the abuse module from acquiring an HTML document through the IWebBrowser2 object.
  • the abuse prevention module may block the acquisition of a component of an HTML document. Since the acquisition of a component of an HTML document may not be for an unauthorized purpose, the abuse prevention module may intercept a predetermined function associated with abuse.
  • a get_value function of an IHTMLInputElement object associated with Internet Explorer may be used for changing a search word input by a user.
  • a getElementByName and getElementsByTagName function of an IHTMLDocument3 object may be used for acquiring a predetermined component of an HTML document and changing a webpage.
  • a get_Images function of the IHTMLDocument3 object may be used for acquiring an image of an HTML document, to change to another image.
  • a type of function acquiring a component of a document used for abuse may not be limited.
  • the COM-based object may have a virtual function table.
  • the virtual function table may include addresses of functions of the browser object.
  • the virtual function table may store addresses of functions provided by the object to an external location.
  • addresses of functions provided by the COM-based object may be stored in the virtual function table, in a predetermined sequence.
  • the browser function extension module may call the function using an address of the function included in the virtual function table.
  • the abuse prevention module may store and back up an address of the original function, corresponding to a position of the original function.
  • the abuse prevention module may store and back up an address of the original function corresponding to a position of the original function desired to be intercepted, using the virtual function table.
  • the original function may correspond to a function to acquire a document through the Internet browser or a function to acquire a predetermined component of the document.
  • a function to acquire a document may correspond to a get_Document function of the IWebBrowser2 object.
  • the get_Document function may be maliciously used to acquire an HTML document of a current Internet browser.
  • the method of preventing browser-based abuse may include hooking and intercepting the get_Document function, to prevent a request of the get_Document function.
  • the function to acquire a predetermined component of a document may correspond to a get_value function of the IHTMLInputElement object, a getElementByName and getElementsByTagName function of an IHTMLDocument2 object, or a get_Images function of the IHTMLDocument2.
  • the position of the original function in the virtual function table may be determined based on the sequence of the functions. For example, a sequence of functions of the IWebBrowser2 object in the virtual function table may be checked through a program such as an OLEView.
  • the abuse prevention module may separately store and back up an address at the position of the original function on the virtual function table. That is, when the original function is requested by a browser function extension module, the abuse prevention module may not unconditionally block the original function. That is, when the browser function extension module requesting the original function corresponds to an authorized module, the abuse prevention module may separately store the address of the original function.
  • the abuse prevention module may declare (designate) the new function having the same format, as the original function.
  • the new function may correspond to a hook function for intercepting the original function.
  • the abuse prevention module may record an address of the declared new function at the position of the original function. That is, the abuse prevention module may intercept the original function and record an address of the hook function, at the position of the original function on the virtual function table, thereby causing the browser function extension module to call the hook function, when the browser function extension module calls the original function.
  • FIG. 4 illustrates a virtual function table 402 corresponding to a browser object 401 .
  • an abuse prevention module 403 may perform a method of preventing browser-based abuse, according to an embodiment of the present invention.
  • a browser function extension module 404 may denote a different module from the abuse prevention module 403 .
  • the abuse prevention module 403 may correspond to a type of module extending a browser function.
  • the abuse prevention module 403 may acquire address information of functions associated with a browser object of an Internet browser.
  • the abuse prevention module 403 may acquire the virtual function table 402 , which stores addresses of functions associated with the browser object of an Internet browser.
  • the browser object 401 may correspond to a COM-based object.
  • a sequence of functions on the virtual function table 402 may be fixed with respect to the COM-based object. That is, a position of each function on the virtual function table 402 may be fixed.
  • the abuse prevention module 403 may search for an address corresponding to a position of the original function, by referencing the virtual function table 402 .
  • the original function may correspond to a function to be intercepted by the abuse prevention module 403 and may include a function to acquire a document indicated through the Internet browser, or a function to acquire a predetermined component of a document.
  • the abuse prevention module 403 may store and back up an address of the original function corresponding to a position of the original function. When a normal module calls the original function, the abuse prevention module 403 may request the original function through the backed up address of the original function.
  • the abuse prevention module 403 may declare a new function having the same format as the original function, and may record an address of the declared new function at a position of the original function in the virtual function table 402 .
  • the new function may denote a hook function for intercepting the original function.
  • the abuse prevention module 403 may substitute an address of the hook function for the address of the original function, at a position of the original function in the virtual function table 402 .
  • the browser function extension module 404 may request the hook function using the address of the hook function recorded at a position of the original function in the virtual function table 402 . In this instance, the browser function extension module 404 may intend to request the original function. However, since the hook function is already substituted for the original function by the abuse prevention module 403 , the browser function extension module 404 may request the hook function.
  • the abuse prevention module 403 may check a browser function extension module requesting the hook function. In this instance, when the hook function is requested, the abuse prevention module 403 may check the browser function extension module requesting the hook function, using information of the browser function extension module placed at an address where the hook function returns, in the hook function.
  • the abuse prevention module 403 may determine whether the module requesting the hook function is a normal module. In this instance, when the module requesting the hook function is included in a white list corresponding to a list of the normal modules used for the Internet browser, the abuse prevention module 403 may designate the module as a normal module.
  • the abuse prevention module 403 may request the backed up original function.
  • the original function may correspond to a function to acquire a document or a function to acquire a predetermined component of the document, and may denote a function capable of acquiring data of the Internet browser.
  • the abuse prevention module 403 may block a request with respect to the previously backed up original function. In conclusion, the abuse prevention module 403 may prevent abuse by blocking an access of the unauthorized browser function extension module 404 attempting to call the new function.
  • FIG. 5 is a flowchart illustrating an operation of substituting an original window procedure function for processing a window message according to an embodiment of the present invention.
  • the Internet browser may provide a currently displayed HTML document (HTML object). That is, a method of preventing browser-based abuse according to FIG. 5 may prevent abuse of acquiring a document through the window message and modifying and changing the document.
  • operation S 201 of substituting a new function for an original function, includes operation S 501 , operation S 502 , and operation S 503 .
  • an abuse prevention module may determine a main window with respect to the Internet browser.
  • the abuse prevention module may determine a main window by requesting a function provided by a browser object of the Internet browser.
  • the abuse prevention module may obtain a handle of a main window of the Internet browser, through an IWebBrowser2 object or API-Hook of a CreateWindowEx function.
  • the browser object may correspond to an object provided to the browser function extension module by the Internet browser, when the Internet browser loads the browser function extension module.
  • the handle of the main window may denote a number for identifying a window.
  • the abuse prevention module may determine a view window with respect to the Internet browser based on the main window.
  • the abuse prevention module may determine a view window, with reference to a window structure of the Internet browser. Since the window structure of the Internet browser may have a different form for each version thereof, the abuse prevention module may check a window structure of the Internet browser depending on a particular version thereof.
  • the view window may denote a window that is displayed on the Internet browser. That is, the view window may denote a window that is actually viewed by a user, among windows of the Internet browser.
  • the abuse prevention module may substitute a new window procedure function for an original window procedure function of the view window, which is processing a message delivered to the Internet browser.
  • the abuse prevention module may substitute a window procedure function through a SetWindowLong function.
  • the process of substituting a new window procedure function may include verifying whether the original window procedure function of the view window has been changed, storing and backing up an address of the original window procedure function, when the original window procedure function has not been not changed, and changing the address of the original window procedure function to an address of the new window procedure function.
  • the process of verifying whether the original window procedure function of the view window has been changed may be implemented as follows. First, the abuse prevention module may obtain the address of the original window procedure function of the view window. Then, the abuse prevention module may retrieve a location of the browser function extension module, where the corresponding procedure function is placed. In this instance, the abuse prevention module may check a module where the procedure function is stored in a memory.
  • the abuse prevention module may check the browser function extension module, based on the retrieved location of the browser function extension module. In this instance, when the checked browser function extension module does not correspond to a module associated with the Internet browser, for example, IEFrame.dll, mshtml.dll, and the like are included in Internet Explorer, the abuse prevention module may determine the original window procedure function has been changed by another browser function extension module.
  • FIG. 6 is a diagram illustrating an operation of preventing abuse, with respect to an original function for processing a window message, according to an embodiment of the present invention.
  • an Internet browser may include a window 605 on a main window 601 .
  • the window 605 may be plural.
  • a window procedure function 606 may be included in each window 605 .
  • a window currently viewed to a user through the Internet browser among the windows 605 may be defined as a view window 602 .
  • the window procedure function may be automatically requested, to process the message.
  • An abuse prevention module may determine a main window with respect to the Internet browser. In this instance, the abuse prevention module may determine the main window using a function provided by a browser object of the Internet browser. The abuse prevention module may determine the view window 602 based on the main window 601 . In this instance, the abuse prevention module may determine the view window with reference to a window structure, depending on a version of the Internet browser.
  • the abuse prevention module may substitute a new window procedure function for an original window procedure function 603 of the view window 602 .
  • an address of the original window procedure function 603 may be separately stored. That is, when a window message 604 with respect to an object for acquiring a document is delivered to a window, the message may be blocked.
  • the abuse prevention module may substitute a new window procedure function, capable of hooking the window message 604 , for the original window procedure function 603 .
  • the abuse prevention module may verify whether the original window procedure function 603 of the view window 602 has been changed, and may store and back up an address of the original window procedure function 603 , when the original window procedure function 603 has not been changed.
  • the abuse prevention module may change the address of the original window procedure function 603 , to an address of the new window procedure function. Through the aforementioned operation, the abuse prevention module may intercept the original window procedure function 603 , before the function 603 is executed.
  • the Internet browser may process the window message 604 delivered to the Internet browser through the window procedure function.
  • the original window procedure function 603 may not be requested, and the substituted new window procedure function may be requested instead.
  • the abuse prevention module may determine whether the window message 604 is a message of an object used for acquiring a document.
  • the abuse prevention module may include an operation for checking a message value of the window message 604 and an operation of comparing a message value of the window message 604 with the checked message value of the object.
  • the abuse prevention module may register and generate the message as a user definition message.
  • the abuse prevention module may directly check the message value with respect to the window message 604 .
  • the abuse prevention module may generate the message and acquire a message value.
  • the message with respect to an object for acquiring a document may be generated through a RegisterWindowMessage function.
  • the abuse prevention module may terminate an operation of processing a window message.
  • the abuse prevention module may request an original window procedure function.
  • an unauthorized browser function extension module may acquire a key message of the Internet browser and intercept a key message.
  • a key message refers to information such as a search word, identification (ID), and the like input by a user.
  • the abuse prevention module may execute a message hooking operation or control a window procedure through hooking, with respect to a substituted function, thereby preventing the acquisition of a key message.
  • the control may be determined based on whether a browser function extension module requesting the corresponding function is included in a list of normal modules.
  • FIG. 7 is a flowchart illustrating an operation of determining whether an access by a browser function extension module through a connection point is an unauthorized access, according to an embodiment of the present invention.
  • the method may prevent abuse by blocking a connection of an unauthorized browser function extension module for accessing the Internet browser.
  • a browser function extension module may correspond to an add-on program with respect to the Internet browser and thus, may be automatically loaded in response to an execution of the Internet browser. Since the browser function extension module may receive a browser object, for example, an IWebBrowser2 object in the case of Internet Explorer, from the Internet browser, and may manipulate and change an HTML document, the method of preventing browser-based abuse may disable an unauthorized browser function extension module. An as example, an abuse prevention module may periodically retrieve an unauthorized browser function extension module to block a connection.
  • operation S 101 includes operation S 701 , operation S 702 , and operation S 703 .
  • the abuse prevention module may extract at least one connection point associated with an operation of the Internet browser, through a browser object of the Internet browser.
  • connection point refers to a connection between the Internet browser and a browser function extension module.
  • the Internet browser may have a plurality of connection points and may provide different information and operations for each connection point.
  • a connection point container may have a connection point object including a connection point.
  • the connection point object may have an identification (ID) of the connection point object and may verify whether a connection point corresponds to a connection point of an operation, through a comparison with an ID associated with an operation of the Internet browser.
  • ID identification
  • Each connection point may include a list of browser function extension modules connected to the connection point.
  • the abuse prevention module may check a browser function extension module connected to each extracted connection point of the Internet browser.
  • the abuse prevention module may check a browser function extension module connected to the connection point, by determining a route between the connection point and the browser function extension module, based on an address of the browser function extension module.
  • the abuse prevention module may use an address of the browser function extension module in a dynamic linking library (DLL) loaded on a memory.
  • DLL dynamic linking library
  • the abuse prevention module may determine whether the checked browser function extension module is an authorized module.
  • the browser function extension module may determine whether the checked browser function extension module corresponds to an authorized module, based on a list of normal browser function extension modules, for example, a white list, used in the Internet browser. That is, when the checked browser function extension module is included in the white list, the abuse prevention module may determine that the browser function extension module is an authorized module.
  • the abuse prevention module may determine that the browser function extension module is an unauthorized module.
  • the abuse prevention module may block a connection of an unauthorized module to the Internet browser.
  • the abuse prevention module may block the connection using a connection sequence value of the connection point.
  • FIG. 8 is a flowchart illustrating an operation of extracting a connection point of an Internet browser, according to an embodiment of the present invention.
  • operation S 701 includes operation S 801 , operation S 802 , and operation S 803 .
  • the abuse prevention module may acquire a connection point container using the browser object.
  • the connection point container may include connection points associated with the Internet browser.
  • the connection point container may include the connection points or may include an object having the connection points.
  • Each connection point of the Internet browser may provide different information and operations.
  • a browser function extension module should be connected to an appropriate connection point to acquire desired information.
  • the abuse prevention module may check a connection point list included in the connection point container.
  • the abuse prevention module may obtain a connection point object, by requesting a function provided by an object of the connection point container.
  • the abuse prevention module may check the connection point list, by requesting a function provided by the connection point object.
  • the abuse prevention module may retrieve a connection point from the connection point list, by using a connection point ID associated with an operation of the Internet browser. In this instance, the abuse prevention module may retrieve a connection point by comparing a previously known connection point ID with the connection point list. Thus, the abuse prevention module may determine whether browser function extension modules connected to each connection point are authorized and may block the connection of an unauthorized browser function extension module.
  • FIG. 9 is a diagram illustrating an operation of preventing abuse through an unauthorized browser function extension module connected to a connection point, according to an embodiment of the present invention.
  • FIG. 9 illustrates a plurality of browser function extension modules 907 - 1 through 907 - 6 connected to an Internet browser 901 .
  • An abuse prevention module may be included in a browser function extension module. The abuse prevention module may extract at least one connection point associated with an operation of the Internet browser 901 .
  • the abuse prevention module may acquire a connection point container 902 using a browser object.
  • the abuse prevention module may check a list of connection points 903 through 906 included in the connection point container 902 . Thereafter, the abuse prevention module may retrieve connection points 904 and 906 associated with an operation, from the list of connection points 903 through 906 , using a connection point ID associated with an operation of the Internet browser.
  • the abuse prevention module may extract a connection point ( 2 ) 904 and a connection point ( 4 ) 906 of the Internet browser 901 .
  • a connection point container may be determined by the browser object.
  • connection point ( 2 ) 904 and the connection point ( 4 ) 906 may be used to check browser function extension modules connected to them. Then the abuse prevention module may check a list of browser function extension modules connected to the connection point ( 2 ) 904 and the connection point ( 4 ) 906 .
  • the list of browser function extension modules may include addresses of the browser function extension modules and connection sequences associated with an operation.
  • a list of browser function extension modules connected to the connection point ( 2 ) 904 includes a browser function extension module ( 1 ) 907 - 1 , a browser function extension module ( 2 ) 907 - 2 , and a browser function extension module ( 3 ) 907 - 3 .
  • a list of browser function extension modules connected to the connection point ( 4 ) 906 may include a browser function extension module ( 4 ) 907 - 4 , a browser function extension module ( 5 ) 907 - 5 , and a browser function extension module ( 6 ) 907 - 6 .
  • the abuse prevention module may determine whether each connected browser function extension module is a normal (authorized) module. In this instance, the abuse prevention module may determine whether a browser function extension m is a normal module, based on a list of normal browser function extension modules associated with the Internet browser, which may be referred to as a white list.
  • the abuse prevention module may block the connections of the browser function extension module ( 2 ) 907 - 2 and the browser function extension module ( 6 ) 907 - 6 .
  • the abuse prevention module may refer to a connection sequence value of the browser function extension module ( 2 ) 907 - 2 and the browser function extension module ( 6 ) 907 - 6 .
  • Remaining browser function extension modules 907 - 1 , 907 - 3 , 907 - 4 , and 907 - 5 may be determined to be normal modules. Thus, the connections thereof may not be blocked by the abuse prevention module. An operation of blocking the connection of unauthorized browser function extension modules may be periodically repeated.
  • an unauthorized browser function extension module may transmit modulated data to the Internet browser, by hooking a function associated with transmitting data to the Internet browser, such as a WinInet function provided in a window.
  • the abuse prevention module may prevent abuse by verifying whether a function associated with data transmission is modulated and hooked by the unauthorized module.
  • the abuse prevention module may verify whether a function is hooked, by verifying whether a CPU jump instruction is input.
  • the input of the CPU jump instructions may be determined by checking an initial portion of a data transmission function.
  • the abuse prevention module may restore the modulated function, by overwriting the modulated portion. Through the restoration operation, a function may be initialized and the abuse prevention module may hook the corresponding function using a function having the same format.
  • the abuse prevention module may determine whether the module requesting the function is a normal module. When the module requesting the function is determined to be a normal module, the abuse prevention module may perform a functional request. Otherwise, the abuse prevention module may block a functional request.
  • FIG. 10 is a diagram illustrating an overall configuration of a system for preventing browser-based abuse 1000 , according to an embodiment of the present invention.
  • the system for preventing browser-based abuse 1000 includes an abuse determining unit 1001 and an abuse blocking unit 1002 .
  • the abuse determining unit 1001 may determine whether an access based on a browser function extension module is an unauthorized access for acquiring data of the Internet browser.
  • the access based on a browser function extension module may include an access of the browser function extension module that attempts to control the Internet browser by connecting to the Internet browser.
  • the access may include an attempt by the browser function extension module intending to acquire data of the Internet browser through a functional call or to deliver a message.
  • the access is not limited thereto, however.
  • the abuse determining unit 1001 may include a function substitution unit 1003 , an object of call checking unit 1004 , and an object of call determining unit 1005 .
  • the browser function extension module may include a BHO connectable to the Internet browser as an add-on, when the Internet browser corresponds to Internet Explorer.
  • the function substitution unit 1003 may substitute a new function for an original function attempting to acquiring data of the Internet browser. In this instance, the function substitution unit 1003 may prevent an unauthorized browser function extension module from executing the original function, by substituting a hook function for the original function.
  • the function substitution unit 1003 will be further described with reference to FIG. 11 and FIG. 12 .
  • the object of call checking unit 1004 may check an object requesting the new function, when the substituted new function is requested through the browser function extension module. For example, when the browser function extension module calls the hook function, the abuse prevention module may examine the browser function extension module corresponding to an object requesting the new function. For example, the object of call checking unit 1004 may check the browser function extension module requesting the new function, using information of the browser function extension module stored at an address where the new function is to return.
  • the object of call determining unit 1005 may determine whether the object requesting the new function is authorized. For example, when the browser function extension module is included in a list of normal browser function extension modules used in the Internet browser, the object of call determining unit 1005 may determine that the browser function extension module is an authorized module.
  • the abuse blocking unit 1002 may block access requested by the unauthorized browser function extension module.
  • the abuse blocking unit 1002 may block a request of the original function capable of acquiring data of the Internet browser. That is, the abuse blocking unit 1002 may block a connection of the browser function extension module to the Internet browser, or may blocking an acquisition of data from the Internet browser.
  • FIG. 11 is a diagram illustrating a function substitution unit 1003 , according to an embodiment of the present invention.
  • the function substitution unit 1003 includes an address information acquisition unit 1101 , an original function backup unit 1102 , a new function declaration unit 1103 , and an address record unit 1104 .
  • the address information acquisition unit 1101 may acquire address information of functions associated with a browser object of an Internet browser.
  • the browser object may include an object based on a COM corresponding to a binary form.
  • the address information acquisition unit 1101 may acquire a virtual function table where addresses associated with the browser object of an Internet browser are stored.
  • the object based on a COM may include the virtual function table.
  • the virtual function table may store addresses of functions of the browser object, which may be provided from the object to the outside. Addresses of functions provided by the COM-based object may be stored in the virtual function table, in a predetermined sequence.
  • the browser function extension module may request the function using an address checked through the virtual function table.
  • the original function backup unit 1102 may store and back up an address of the original function, corresponding to a position of the original function in the address information.
  • the original function backup unit 1102 may store and back up an address of the original function, corresponding to a position of the original function to be intercepted using the virtual function table.
  • the original function may be a function to acquire a document or a portion thereof, through the Internet browser.
  • the new function declaration unit 1103 may declare the new function having the same format as the original function.
  • the new function may correspond to a hook function for interception the original function.
  • the address record unit 1104 may record an address of the declared new function at the position of the original function.
  • the address record unit 1104 may record an address of the hook function at the position of the original function in the virtual function table, thereby causing the browser function extension module to request the hook function, when the browser function extension module requests the original function.
  • FIG. 12 is a diagram illustrating a function substitution unit 1003 , according to another embodiment of the present invention.
  • the function substitution unit 1003 includes a main window determining unit 1201 , a view window determining unit 1202 , and an original function substitution unit 1203 .
  • the main window determining unit 1201 may identify a main window of the Internet browser.
  • the main window determining unit 1201 may identify the main window using a function provided by a browser object of the Internet browser.
  • the browser object may be an object provided by the Internet browser to a browser function extension module, when the Internet browser loads the browser function extension module.
  • the view window determining unit 1202 may identify a view window of the Internet browser, based on the main window. As an example, the view window determining unit 1202 may identify a view window with reference to a window structure, depending on a version of the Internet browser. Since the window structure of the Internet browser may have a different form for each version, the view window determining unit 1202 may check a window structure depending on a particular version. The view window may denote a window at a position where a page is actually viewed on the Internet browser.
  • the original function substitution unit 1203 may substitute a new window procedure function for an original window procedure function of the view window, when the view window is processing a message delivered to the Internet browser.
  • the object of call checking unit 1004 may check a message using a message value of the message requesting the new window procedure function, when the new window procedure function is requested by the message.
  • the object of call determining unit 1005 may determine that a message corresponding to an object requesting the new function is authorized, when the message does not correspond to a message for acquiring a document of the Internet browser.
  • the abuse determining unit 1002 may prevent a message from being delivered to the original function, when the message is an unauthorized message for acquiring data of the Internet browser.
  • the original function substitution unit 1203 may include a function change checking unit 1204 , a function backup unit 1205 , and a function address changing unit 1206 .
  • the function change checking unit 1204 may verify whether the original window procedure function of the view window has been changed to another window procedure function.
  • the function change checking unit 1204 may obtain an address of the original window procedure function.
  • the function change checking unit 1204 may retrieve a route of a browser function extension module including the corresponding procedure function.
  • the function change checking unit 1204 may check a module where the procedure function is stored in a memory.
  • the function change checking unit 1204 may check the browser function extension module based on the retrieved route of the browser function extension module. In this instance, when the checked browser function extension module does not correspond to a module associated with the Internet browser, for example, IEFrame.dll, mshtml.dll, and the like of Internet Explorer, the function change checking unit 1204 may determine that the original window procedure function has been changed by another browser function extension module.
  • the function backup unit 1205 may store and back up an address of the original window procedure function of the view window, when the original window procedure function is confirmed to have been unchanged. That is, when a delivered message does not correspond to a message for acquiring a document, the function backup unit 1205 may store and back up the original window procedure function, so as to be able to call the original window procedure function.
  • the function address changing unit 1206 may change the address of the original window procedure function to an address of the new window procedure function.
  • the function address changing unit 1206 may prevent the original window procedure function from being requested by an unauthorized message, by substituting the new window procedure function for the original window procedure function.
  • FIG. 13 is a diagram illustrating another abuse determining unit 1001 , according to an embodiment of the present invention.
  • the abuse determining unit 1001 includes a connection point extraction unit 1301 , a module checking unit 1302 , and a module determining unit 1303 .
  • the connection point extraction unit 1301 may extract at least one connection point associated with an operation of an Internet browser through a browser object of the Internet browser.
  • the connection point may denote a point of connection between the Internet browser and a browser function extension module.
  • the connection point extraction unit 1301 may include a container acquisition unit 1304 , a list checking unit 1305 , and a connection point retrieving unit 1306 .
  • the container acquisition unit 1304 may acquire a connection point container using the browser object.
  • the connection point container may include connection points associated with the Internet browser.
  • the connection point container may include an object having the connection points. Each connection point may provide different information and operations.
  • the list checking unit 1305 may check a connection point list included in the connection point container.
  • the list checking unit 1305 may obtain a connection point object by requesting a function provided by an object of the connection point container.
  • the list checking unit 1305 may check the connection point list by requesting a function of the connection point object.
  • the connection point retrieving unit 1306 may retrieve a connection point from the connection point list, using a connection point ID associated with the Internet browser.
  • the connection point retrieving unit 1306 may retrieve a connection point by comparing a previously known connection point ID associated with an operation of the Internet browser with the connection point list.
  • the module checking unit 1302 may check a browser function extension module connected to each extracted connection point of the Internet browser. As an example, the module checking unit 1302 may check a browser function extension module connected to the connection point, by determining a route between the connection point and the browser function extension module, using an address of the browser function extension module.
  • the module determining unit 1303 may determine whether the checked browser function extension module is authorized. The module determining unit 1303 may determine whether the checked browser function extension module is authorized using a list of normal browser function extension modules used in the Internet browser.
  • the abuse blocking unit 1002 may block a connection of the browser function extension module using a connection sequence value of the connection point, when the browser function extension module connected to the connection point is an unauthorized module.
  • FIG. 1 through FIG. 9 may be referred to for aspects omitted from the description of FIG. 10 through FIG. 13 .
  • the exemplary embodiments according to the present invention may be recorded in non-transitory computer-readable media including program instructions to implement various operations embodied by a computer.
  • the media may also include, alone or in combination with the program instructions, data files, data structures, and the like.
  • the media and program instructions may be those specially designed and constructed for the purposes of the present invention, or they may be of the well-known variety and available to those having skill in the computer software arts.
  • non-transitory computer-readable media examples include magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD ROM discs and DVD; magneto-optical media such as optical discs; and hardware devices that are specially configured to store and perform program instructions, such as read-only memory (ROM), random access memory (RAM), flash memory, and the like.
  • program instructions include both machine code, such as produced by a compiler, and files containing higher level code that may be executed by the computer using an interpreter.
  • the described hardware devices may be configured to act as one or more software modules in order to perform the operations of the above-described embodiments of the present invention.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Information Transfer Between Computers (AREA)
  • Computer And Data Communications (AREA)
  • Storage Device Security (AREA)
US13/126,645 2008-11-03 2009-11-03 Method and system for preventing browser-based abuse Active 2030-09-14 US8997253B2 (en)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
KR10-2008-0108354 2008-11-03
KR1020080108354A KR101074624B1 (ko) 2008-11-03 2008-11-03 브라우저 기반 어뷰징 방지 방법 및 시스템
PCT/KR2009/006435 WO2010062063A2 (fr) 2008-11-03 2009-11-03 Procédé et système pour prévenir une utilisation illicite liée à un logiciel de navigation

Publications (2)

Publication Number Publication Date
US20110283366A1 US20110283366A1 (en) 2011-11-17
US8997253B2 true US8997253B2 (en) 2015-03-31

Family

ID=42226218

Family Applications (1)

Application Number Title Priority Date Filing Date
US13/126,645 Active 2030-09-14 US8997253B2 (en) 2008-11-03 2009-11-03 Method and system for preventing browser-based abuse

Country Status (4)

Country Link
US (1) US8997253B2 (fr)
JP (2) JP5554338B2 (fr)
KR (1) KR101074624B1 (fr)
WO (1) WO2010062063A2 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9930095B2 (en) 2014-03-26 2018-03-27 Google Llc System for managing extension modifications to web pages

Families Citing this family (35)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20120011653A (ko) * 2010-07-29 2012-02-08 삼성전자주식회사 영상 처리 장치 및 방법
KR101277516B1 (ko) 2010-11-03 2013-07-30 주식회사 안랩 프로세스 외부 접근 차단 장치와 방법 및 컴퓨터 프로그램이 기록된 기록매체
KR101369253B1 (ko) * 2012-05-10 2014-03-06 주식회사 안랩 웹 페이지의 정보 변조 차단 장치 및 방법
CN103777855B (zh) * 2012-10-23 2018-09-21 腾讯科技（深圳）有限公司 截取移动终端屏幕的方法和装置
US9210155B2 (en) * 2013-03-08 2015-12-08 Stocktree Inc. System and method of extending a host website
US10430894B2 (en) 2013-03-21 2019-10-01 Khoros, Llc Gamification for online social communities
KR101462114B1 (ko) 2013-03-28 2014-11-17 네이버 주식회사 동기식 스크립트 지연 로딩 시스템, 방법 및 컴퓨터 판독 가능한 기록 매체
CN104503752A (zh) * 2014-12-17 2015-04-08 青岛海信电器股份有限公司 一种智能设备中控制网页调用系统功能的方法及装置
GB2546304B (en) * 2016-01-14 2020-04-08 Avecto Ltd Computer device and method for controlling access to a web resource
US9501439B1 (en) * 2016-01-19 2016-11-22 International Business Machines Corporation Communicating in an integrated circuit using hardware-managed virtual channels
US10326790B2 (en) * 2016-02-12 2019-06-18 Shape Security, Inc. Reverse proxy computer: deploying countermeasures in response to detecting an autonomous browser executing on a client computer
KR102661890B1 (ko) * 2016-06-15 2024-04-29 에스케이플래닛 주식회사 광고플랫폼장치 및 그 동작 방법
US10594731B2 (en) 2016-03-24 2020-03-17 Snowflake Inc. Systems, methods, and devices for securely managing network connections
US10063533B2 (en) * 2016-11-28 2018-08-28 International Business Machines Corporation Protecting a web server against an unauthorized client application
US10902462B2 (en) 2017-04-28 2021-01-26 Khoros, Llc System and method of providing a platform for managing data content campaign on social networks
US11570128B2 (en) 2017-10-12 2023-01-31 Spredfast, Inc. Optimizing effectiveness of content in electronic messages among a system of networked computing device
US10785222B2 (en) * 2018-10-11 2020-09-22 Spredfast, Inc. Credential and authentication management in scalable data networks
US10346449B2 (en) 2017-10-12 2019-07-09 Spredfast, Inc. Predicting performance of content and electronic messages among a system of networked computing devices
US10999278B2 (en) 2018-10-11 2021-05-04 Spredfast, Inc. Proxied multi-factor authentication using credential and authentication management in scalable data networks
US11470161B2 (en) 2018-10-11 2022-10-11 Spredfast, Inc. Native activity tracking using credential and authentication management in scalable data networks
US11050704B2 (en) 2017-10-12 2021-06-29 Spredfast, Inc. Computerized tools to enhance speed and propagation of content in electronic messages among a system of networked computing devices
US10601937B2 (en) 2017-11-22 2020-03-24 Spredfast, Inc. Responsive action prediction based on electronic messages among a system of networked computing devices
US10594773B2 (en) 2018-01-22 2020-03-17 Spredfast, Inc. Temporal optimization of data operations using distributed search and server management
US11061900B2 (en) 2018-01-22 2021-07-13 Spredfast, Inc. Temporal optimization of data operations using distributed search and server management
KR102038957B1 (ko) 2018-10-11 2019-10-31 넷마블 주식회사 게임 어뷰저 검출 방법 및 장치
US10855657B2 (en) 2018-10-11 2020-12-01 Spredfast, Inc. Multiplexed data exchange portal interface in scalable data networks
US10931540B2 (en) 2019-05-15 2021-02-23 Khoros, Llc Continuous data sensing of functional states of networked computing devices to determine efficiency metrics for servicing electronic messages asynchronously
US11128589B1 (en) 2020-09-18 2021-09-21 Khoros, Llc Gesture-based community moderation
US11438289B2 (en) 2020-09-18 2022-09-06 Khoros, Llc Gesture-based community moderation
US12120078B2 (en) 2020-09-18 2024-10-15 Khoros, Llc Automated disposition of a community of electronic messages under moderation using a gesture-based computerized tool
US11627100B1 (en) 2021-10-27 2023-04-11 Khoros, Llc Automated response engine implementing a universal data space based on communication interactions via an omnichannel electronic data channel
US11924375B2 (en) 2021-10-27 2024-03-05 Khoros, Llc Automated response engine and flow configured to exchange responsive communication data via an omnichannel electronic communication channel independent of data source
US11438282B2 (en) 2020-11-06 2022-09-06 Khoros, Llc Synchronicity of electronic messages via a transferred secure messaging channel among a system of various networked computing devices
US11714629B2 (en) 2020-11-19 2023-08-01 Khoros, Llc Software dependency management
EP4053722B1 (fr) * 2021-03-01 2023-11-29 Irdeto B.V. Code informatique sécurisé et systèmes, procédés et supports de stockage pour la création de code informatique sécurisé à partir d'un code informatique d'origine

Citations (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030061309A1 (en) * 2001-09-24 2003-03-27 International Business Machines Corp. Method and system for providing browser functions on a web page for client-specific accessibility
JP2005166051A (ja) 2003-12-03 2005-06-23 Inca Internet Co Ltd プロセスの不正アクセス防止方法
US20050229188A1 (en) * 2004-04-08 2005-10-13 International Business Machines Corporation Communication between browser windows
KR20060028463A (ko) 2006-03-09 2006-03-29 정성욱 온라인 광고 시스템에서의 이용자 부정 클릭 추적과 방지시스템 및 그 방법
KR20060112849A (ko) 2005-04-28 2006-11-02 (주)밀리언커뮤니케이션 씨피씨 광고 부정클릭 모니터링 방법 및 그 장치
US20060294176A1 (en) * 2002-01-28 2006-12-28 Hitachi, Ltd. Customizable information processing apparatus
KR20070090312A (ko) 2006-03-02 2007-09-06 엔에이치엔(주) 스팸 지수 산정 방법 및 시스템
US20070250531A1 (en) * 2006-04-24 2007-10-25 Document Advantage Corporation System and Method of Web Browser-Based Document and Content Management
US20080184157A1 (en) * 2007-01-30 2008-07-31 Oracle International Corp. Enterprise web browser extension
US20080184358A1 (en) * 2007-01-26 2008-07-31 Verdasys, Inc. Ensuring trusted transactions with compromised customer machines
US20090100263A1 (en) * 2007-10-15 2009-04-16 Sean Joseph Leonard Methods and systems for encouraging secure communications
US20090259839A1 (en) * 2007-07-12 2009-10-15 Nhn Corporation Security authentication system and method
US20090281816A1 (en) 2005-08-29 2009-11-12 Daikin Industries, Ltd. Account abuse detection or prevention device, data collection device, and account abuse detection or prevention program
US7975308B1 (en) * 2007-09-28 2011-07-05 Symantec Corporation Method and apparatus to secure user confidential data from untrusted browser extensions
US8065734B1 (en) * 2008-03-06 2011-11-22 Symantec Corporation Code module operating system (OS) interactions intercepting system and method

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4545317B2 (ja) * 1998-10-28 2010-09-15 ヤフー！ インコーポレイテッド インターネットブラウザインターフェースの制御方法、及び制御可能なブラウザインターフェイス
JP4232431B2 (ja) * 2002-10-18 2009-03-04 株式会社日立製作所 ブラウザー関連のセキュリティチェックプログラム
US7278114B2 (en) * 2002-12-30 2007-10-02 Viewspace Technologies Method and apparatus for managing display of popup windows
JP4239682B2 (ja) * 2003-05-22 2009-03-18 日本精工株式会社 ローラクラッチ及びローラクラッチ内蔵型プーリ装置
US8332943B2 (en) * 2004-02-17 2012-12-11 Microsoft Corporation Tiered object-related trust decisions
US20050268112A1 (en) * 2004-05-28 2005-12-01 Microsoft Corporation Managing spyware and unwanted software through auto-start extensibility points

Patent Citations (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030061309A1 (en) * 2001-09-24 2003-03-27 International Business Machines Corp. Method and system for providing browser functions on a web page for client-specific accessibility
US20060031759A1 (en) * 2001-09-24 2006-02-09 Brown Frances C Method and system for providing browser functions on a web page for client-specific accessibility
US20060294176A1 (en) * 2002-01-28 2006-12-28 Hitachi, Ltd. Customizable information processing apparatus
JP2005166051A (ja) 2003-12-03 2005-06-23 Inca Internet Co Ltd プロセスの不正アクセス防止方法
US20050229188A1 (en) * 2004-04-08 2005-10-13 International Business Machines Corporation Communication between browser windows
KR20060112849A (ko) 2005-04-28 2006-11-02 (주)밀리언커뮤니케이션 씨피씨 광고 부정클릭 모니터링 방법 및 그 장치
US20090281816A1 (en) 2005-08-29 2009-11-12 Daikin Industries, Ltd. Account abuse detection or prevention device, data collection device, and account abuse detection or prevention program
KR20070090312A (ko) 2006-03-02 2007-09-06 엔에이치엔(주) 스팸 지수 산정 방법 및 시스템
US20080301811A1 (en) 2006-03-09 2008-12-04 Sung Wook Jung System For Stabilizing of Web Service and Method Thereof
KR20070092656A (ko) 2006-03-09 2007-09-13 정성욱 웹 서비스 안정화 시스템 및 그 방법
KR20060028463A (ko) 2006-03-09 2006-03-29 정성욱 온라인 광고 시스템에서의 이용자 부정 클릭 추적과 방지시스템 및 그 방법
US20070250531A1 (en) * 2006-04-24 2007-10-25 Document Advantage Corporation System and Method of Web Browser-Based Document and Content Management
US20080184358A1 (en) * 2007-01-26 2008-07-31 Verdasys, Inc. Ensuring trusted transactions with compromised customer machines
US20080184157A1 (en) * 2007-01-30 2008-07-31 Oracle International Corp. Enterprise web browser extension
US20080184159A1 (en) * 2007-01-30 2008-07-31 Oracle International Corp Toolbar/sidebar browser extension
US20080184141A1 (en) * 2007-01-30 2008-07-31 Oracle International Corp Menu creation browser extension
US20080184158A1 (en) * 2007-01-30 2008-07-31 Orale International Corp Web browser window management
US20090259839A1 (en) * 2007-07-12 2009-10-15 Nhn Corporation Security authentication system and method
US7975308B1 (en) * 2007-09-28 2011-07-05 Symantec Corporation Method and apparatus to secure user confidential data from untrusted browser extensions
US20090100263A1 (en) * 2007-10-15 2009-04-16 Sean Joseph Leonard Methods and systems for encouraging secure communications
US8065734B1 (en) * 2008-03-06 2011-11-22 Symantec Corporation Code module operating system (OS) interactions intercepting system and method

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
International Search Report of PCT/KR2009/006435 issued on May 31, 2010.
Japanese Office Action dated Jan. 7, 2014 in corresponding Application No. 2011-534404.
Provos et al. , The Ghost in the Browser Analysis of Web-based Malwate, 2007, Google Inc. *
Yu et al., JavaScript instrumentation for browser security, 2007, DoCoMo Communications Laboratories USA Inc. *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9930095B2 (en) 2014-03-26 2018-03-27 Google Llc System for managing extension modifications to web pages

Also Published As

Publication number Publication date
JP2014142960A (ja) 2014-08-07
WO2010062063A3 (fr) 2010-07-29
JP5554338B2 (ja) 2014-07-23
US20110283366A1 (en) 2011-11-17
WO2010062063A2 (fr) 2010-06-03
JP2012507778A (ja) 2012-03-29
KR101074624B1 (ko) 2011-10-17
JP5863869B2 (ja) 2016-02-17
KR20100049258A (ko) 2010-05-12

Similar Documents

Publication Publication Date Title
US8997253B2 (en) Method and system for preventing browser-based abuse
EP3136277B1 (fr) Système de réseau de détection d'activité illicite et procédé de détection d'activité illicite
US8353033B1 (en) Collecting malware samples via unauthorized download protection
US9531734B2 (en) Method and apparatus for intercepting or cleaning-up plugins
US20130247198A1 (en) Emulator updating system and method
US20130160126A1 (en) Malware remediation system and method for modern applications
CN106326735B (zh) 防注入的方法和装置
US8813229B2 (en) Apparatus, system, and method for preventing infection by malicious code
MX2007011026A (es) Metodo y sistema para la deteccion de codigo extrano.
CN114417335A (zh) 一种恶意文件检测方法、装置、电子设备及存储介质
US8381300B2 (en) Offline extraction of configuration data
CN112698797A (zh) 一种文件打印控制方法、系统、电子设备及存储介质
CN107103243B (zh) 漏洞的检测方法及装置
CN115221524A (zh) 业务数据保护方法、装置、设备及存储介质
KR101781780B1 (ko) 다중 서버, 다중 브라우저 기반의 고속 악성 웹 사이트 탐지 시스템 및 방법
CN113536242A (zh) 动态库调用方法、装置、终端设备以及存储介质
EP2228722B1 (fr) Système et procédé de surveillance de l'intégrité d'un fichier en utilisant des horodatages
US20220256006A1 (en) Methods for controlling tracking elements of a web page and related electronic devices
CN106682512B (zh) 一种防止程序被修改的方法及其装置、系统
CN112579330B (zh) 操作系统异常数据的处理方法、装置及设备
US8307365B2 (en) Apparatus and method for managing execution of activeX control
KR101716690B1 (ko) 데이터 무단 엑세스 차단 방법 및 그 기능이 구비된 컴퓨팅 장치
KR20000006402A (ko) 클래스로우더
CN111611578B (zh) 一种检测powershadow虚拟环境的方法及其系统
JP7255681B2 (ja) 実行制御システム、実行制御方法、及びプログラム

Legal Events

Date Code Title Description
AS Assignment

Owner name: NHN BUSINESS PLATFORM CORPORATION, KOREA, REPUBLIC

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:KWON, OH-HYUN;KIM, HYUN-JONG;LEE, CHANG-HWAN;REEL/FRAME:026667/0385

Effective date: 20110607

FEPP Fee payment procedure

Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

STCF Information on status: patent grant

Free format text: PATENTED CASE

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551)

Year of fee payment: 4

AS Assignment

Owner name: NAVER CLOUD CORP., KOREA, REPUBLIC OF

Free format text: CHANGE OF NAME;ASSIGNOR:NAVER BUSINESS PLATFORM CORP.;REEL/FRAME:056444/0655

Effective date: 20130802

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 8